CVE-2023-4956

A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected that the config-editor page is vulnerable to clickjacking. This flaw allows an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance.

• CWE-1021
• CWE-1021

• https://access.redhat.com/security/cve/CVE-2023-4956Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2238886Issue Tracking
• https://access.redhat.com/security/cve/CVE-2023-4956Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2238886Issue Tracking

Published

Nov 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49554Use After Free vulnerability in YASM 1.3.0.86.g9def allows a…5.5
• CVE-2023-49555An issue in YASM 1.3.0.86.g9def allows a remote attacker to …5.5
• CVE-2023-49556Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows …5.5
• CVE-2023-49557An issue in YASM 1.3.0.86.g9def allows a remote attacker to …5.5
• CVE-2023-49558An issue in YASM 1.3.0.86.g9def allows a remote attacker to …5.5
• CVE-2023-49559An issue in vektah gqlparser open-source-library v.2.5.10 al…3.7
• CVE-2023-49563Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v…6.1
• CVE-2023-49564The CBIS/NCS Manager API is vulnerable to an authentication …8.8
• CVE-2023-49565The cbis_manager Podman container is vulnerable to remote co…8.4
• CVE-2023-49566 In Apache Linkis <=1.5.0, due to the lack of effective filt…8.8
• CVE-2023-49567A vulnerability has been identified in the Bitdefender Total…6.8
• CVE-2023-49568A denial of service (DoS) vulnerability was discovered in go…7.5